Your privacy matters. This policy explains how we collect, use, and protect your data in compliance with UK GDPR and the Data Protection Act 2018.
UK GDPR Compliant
This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Contents
Rezzy Ltd ("Rezzy", "we", "us", "our") is the data controller responsible for your personal data when you use the Rezzy platform at rezzy.co.uk.
Data Controller: Rezzy Ltd
Website: rezzy.co.uk
Contact: privacy@rezzy.co.uk
Where a Business Owner uses Rezzy to manage their customer bookings, the Business Owner is the Data Controller for their customers' data, and Rezzy acts as the Data Processor.
2.1 Information you provide directly:
2.2 Information collected automatically:
2.3 Information from third parties:
We use your personal data for the following purposes:
| Purpose | Details |
|---|---|
| Providing the Service | Creating and managing your account, processing bookings, managing staff and customer records |
| Billing & Payments | Processing subscription payments, customer booking payments, Stripe Connect payouts, platform fees, invoices, receipts, refunds, disputes, and payment reconciliation |
| Communications | Sending booking confirmations, reminders, notifications, and support responses |
| Platform Improvement | Analysing usage to improve features, fix bugs, and develop new functionality |
| Security | Detecting and preventing fraud, abuse, and unauthorised access |
| Legal Compliance | Complying with our legal obligations including tax, accounting, and regulatory requirements |
| Marketing | Sending promotional emails where you have given consent (you can opt out at any time) |
Under UK GDPR, we must have a lawful basis to process your personal data. We rely on the following:
We do not sell your personal data. We may share your data with trusted third parties only as necessary to provide the Service:
Stripe
Payment processing, Stripe Connect onboarding, payouts, fees, refunds, disputes, and payment fraud checks. PCI-DSS Level 1 certified.
stripe.com/gb/privacyGoogle Calendar integration and Google Cloud Storage (if enabled).
policies.google.com/privacyWe may also disclose data to law enforcement or regulatory bodies if required by law, or to protect the rights, property, or safety of Rezzy, our users, or others.
Some of our third-party service providers operate outside the UK and European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including:
We retain your personal data for as long as necessary to provide the Service and comply with our legal obligations:
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion request |
| Booking records | 6 years (UK tax and legal compliance) |
| Payment records | 7 years (HMRC requirements) |
| Support communications | 3 years from last interaction |
| Marketing preferences | Until consent is withdrawn |
| Server logs | 90 days |
| Cookies (session) | Deleted when browser is closed |
Under the UK GDPR and Data Protection Act 2018, you have the following rights:
Right to Access
Request a copy of the personal data we hold about you (Subject Access Request).
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data ("right to be forgotten") where there is no lawful reason to retain it.
Right to Restriction
Request that we restrict processing of your data in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format and transfer it to another provider.
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes.
Automated Decisions
Not be subject to solely automated decisions that significantly affect you.
Right to Withdraw Consent
Withdraw consent at any time where processing is based on consent.
How to exercise your rights
Email us at privacy@rezzy.co.uk with your request. We will respond within 30 days. We may need to verify your identity before processing your request. There is no charge for most requests.
The Rezzy platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data without parental consent, we will delete it.
Business Owners who offer services to children are responsible for obtaining appropriate parental consent under applicable law.
When you use Rezzy to manage your business, your customers' personal data is processed by Rezzy on your behalf. In this context:
Our Data Processing Agreement (DPA) — which forms part of our Terms of Service — sets out our respective obligations under UK GDPR Article 28.
We implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access, including:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33.
We will only send you marketing emails if you have explicitly opted in. You can unsubscribe at any time by:
Transactional emails (such as booking confirmations, payment receipts, and account notices) are not marketing emails and will continue to be sent as part of the Service.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the platform. The "Last updated" date at the top of this page will always reflect the most recent version.
We encourage you to review this policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
Rezzy Ltd — Data Privacy
privacy@rezzy.co.uk
rezzy.co.uk
Right to complain to the ICO
If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
0303 123 1113
We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.
© 2026 Rezzy Ltd. All rights reserved.